Bug 1363431: wasm: Check for maximum br_table size; r=luke

MozReview-Commit-ID: 2Q2pWi5NSn7

--HG--
extra : rebase_source : a778197f93e3ea208e3d0bf067254e37aca6fa9f

js/src/wasm/WasmBinaryIterator.h

@@ -1081,6 +1081,9 @@ OpIter<Policy>::readBrTable(Uint32Vector* depths, uint32_t* defaultDepth,
     if (!readVarU32(&tableLength))
         return fail("unable to read br_table table length");
 
+    if (tableLength > MaxBrTableElems)
+        return fail("br_table too big");
+
     if (!popWithType(ValType::I32, index))
         return false;